Privacy notice
How Mudu collects, uses and protects personal data, who we share it with, and the rights you have. We've written it in plain English. If anything is unclear, email us.
1. Who we are
Mudu (mudu.live) is run by MUDU SOLUTIONS LTD, a company registered in England and Wales with company number 17506109. Our registered office is 66 Paul Street, London EC2A 4NA, United Kingdom.
For personal data we decide how to use, we are the controller. We are registered with the Information Commissioner's Office (ICO) under registration number ZC278019.
Contact us about anything in this notice at connect@mudu.live. We have not appointed a Data Protection Officer because the law doesn't require one for a business of our size and type. Our privacy contact is reached at the same address.
2. Two roles: our data and our customers' data
Mudu is a shared inbox that businesses ("shops") use to talk to their own customers on WhatsApp, Instagram, Facebook Messenger, TikTok and Telegram. That means we handle personal data in two different roles.
When we are the controller
For people who visit our website, sign up, use Mudu as a shop owner or team member, pay us, or contact us. This notice covers that data in full.
When we act for a shop (processor)
When a shop's customer sends that shop a message, the shop decides what happens to it. The shop is the controller and we are its processor: we store and handle the messages, contacts, files and notes only on the shop's instructions, under a data processing agreement that forms part of our Terms.
Messaged a shop that uses Mudu? The shop's own privacy notice applies to you. Please contact the shop to see, correct or delete your data. If you contact us instead, we'll pass your request to the shop and help them answer it.
3. What we collect
When you visit mudu.live
- Technical data our servers record automatically: IP address, browser and device type, pages requested and the time. We use this for security and to keep the site running.
- Your language choice, stored in your own browser (see Cookies).
- Only if you accept analytics cookies: Google Analytics records which pages you view, how you reached us (for example a search engine, a social post or a link with a campaign tag), your approximate location (country and city, worked out from your IP address, which Google Analytics does not store), your device and browser type, and which buttons you click. We look at this only as counts and totals.
When you sign up and use Mudu
- Account details: name, email address, phone number (if you give it), business name, and your role in the team.
- Sign-in data: one-time sign-in codes we email you, session records, and the IP address and device used to sign in.
- Team members: if a shop owner invites you, we receive your name and email from them.
- Activity records: a log of important actions in your account (for example who changed a setting or deleted a contact), kept so shops can see who did what.
- Connected channels: the IDs of the WhatsApp, Instagram, Facebook, TikTok or Telegram accounts you connect, and the access tokens that let Mudu send and receive messages for you.
- Billing: billing name and address, plan, invoices and whether they've been paid. We do not store card numbers; Wayl (wayl.io) handles payments.
- Support and setup: anything you send us, and notes from setup calls if you join our setup service.
Content shops put into Mudu (we act for the shop)
Messages, photos, voice notes and files exchanged with customers; customer names, profile details and phone numbers provided by the messaging platform; contact records, tags and notes added by the shop; and shop information the shop uploads for Mudu AI (prices, policies, FAQs).
We don't ask for special category data (such as health, religion or ethnicity). Customers can still choose to write anything in a message, so shops should avoid asking for it unless they need it.
4. How we use it and why we're allowed to
UK data protection law says we need a lawful basis for each use. These are ours:
| What we do | Lawful basis |
|---|---|
| Create your account, sign you in, and run the inbox, channels and features you use | Contract. We need it to provide the service you signed up for. For team members invited by a shop: legitimate interests (letting the shop give its team access). |
| Send service messages: sign-in codes, security alerts and important changes by email, and invoices and billing notices in the app | Contract |
| Bill you and keep accounting and tax records | Contract, and legal obligation (UK company and tax law) |
| Keep Mudu secure, stop abuse and fraud, and fix errors | Legitimate interests: protecting our service, our customers and their customers |
| Answer support requests and run the setup service | Contract, or legitimate interests if you're not a customer yet |
| Understand how Mudu is used, using counts and totals, to improve it | Legitimate interests: making the product better. We do not read shops' conversations for this. |
| Measure how people find and use our website with Google Analytics | Your consent. You can withdraw it at any time with the Cookie settings link at the bottom of mudu.live. |
| Send product news and offers | Your consent, or for existing customers, legitimate interests about similar services. Every email has an unsubscribe link. |
| Comply with the law, respond to lawful requests, and handle legal claims | Legal obligation, or legitimate interests in defending our rights |
Where we rely on legitimate interests, we have checked that our interest isn't outweighed by your rights. You can object at any time (see Your rights).
You need to give us your name and email to have an account. Everything else is optional unless the feature needs it.
5. Mudu AI
Shops can choose to use Mudu AI. It works in two ways:
- Helper tools suggest, translate or rewrite a reply. A person always reads it and decides whether to send it.
- AI teammate, if the shop switches it on, answers customers by itself using the shop's own information, and hands the chat to a person when it should.
To do this, the relevant messages and shop information are sent to our AI providers (listed in section 6) to produce a reply. Our providers process this under commercial terms that do not allow them to use it to train their AI models. We do not use shops' or their customers' messages to train AI models either.
Mudu AI does not make decisions about people that have legal or similarly significant effects. It answers questions, writes up orders and changes bookings as the shop has set it up to, and a shop's team can see and change everything it does.
Shops that use the AI teammate are responsible for telling their customers that some replies may come from AI.
7. Data sent outside the UK
Some providers above are in the USA, the EU or Iraq. When personal data leaves the UK, we make sure it stays protected by using one of these:
- a country the UK has approved as giving adequate protection (this includes the EU/EEA);
- the UK Extension to the EU–US Data Privacy Framework, for US companies certified under it; or
- the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
Email us for more detail on the safeguard used for a particular provider.
8. How long we keep it
We keep personal data only as long as we need it:
| Data | How long |
|---|---|
| Account details | While your account is open, then deleted within 90 days of closing it |
| Shop content: chats, contacts, files, shop information | While the shop's account is open. Shops can delete it at any time. Deleted within 90 days of the account closing |
| Backups | Overwritten within 10 days |
| Invoices and payment records | 6 years from the end of the financial year they relate to, as UK tax law requires |
| Sign-in sessions | 30 days, or until you sign out |
| Server and security logs | Up to 5 weeks |
| Website analytics | 14 months, then deleted by Google Analytics automatically |
| Support emails | 1 year after the conversation ends |
| Marketing preferences | Until you unsubscribe. After that we keep just your email on a "do not contact" list so we never email you again |
We may keep data longer if the law requires it or we need it for a legal claim.
9. How we protect it
- All connections to Mudu are encrypted (HTTPS/TLS).
- Access tokens for connected channels and other secrets are encrypted when stored.
- Each shop's data is kept separate at the database level, so one shop can't see another's.
- Staff access is limited to what's needed and is logged.
- Sign-in uses one-time codes sent to your email, not reusable passwords.
If a breach puts your data at risk, we'll tell the ICO within 72 hours where the law requires, and tell you without undue delay if there is a high risk to you. For shop content, we'll tell the affected shop without undue delay so they can do the same.
10. Your rights
Under UK GDPR you have the right to:
- see the personal data we hold about you and get a copy;
- correct data that is wrong or incomplete;
- delete your data in some situations;
- limit how we use it in some situations;
- object to us using it on the basis of legitimate interests, and always to direct marketing;
- take it with you in a common, machine-readable format;
- withdraw consent at any time, where we rely on it;
- not be subject to decisions made solely by automated means that have legal or similarly significant effects on you.
To use any of these, email connect@mudu.live. It's free. We may ask you to confirm your identity. We'll reply within one month, or tell you within that month if we need up to two more months because the request is complex.
If your request is about messages you sent to a shop, see section 2.
11. Deleting your data and disconnecting channels
- Shop owners can delete conversations and contacts in the app, and disconnect any channel in Settings › Channels. Disconnecting stops new messages reaching Mudu.
- Shop owners can download a copy of their contacts and conversations at any time in Settings › Privacy & data, and cancel their plan in Settings › Billing.
- To close your account and delete everything, email connect@mudu.live from the account's email address. We'll confirm when it's done.
- Facebook and Instagram: you can also remove Mudu's access in your Facebook settings under Business Integrations, or in Meta Business Suite. This stops access; to delete the data we already hold, email us as above.
- Customers of a shop: contact the shop, or email us and we'll pass your request on.
13. Children
Mudu is a service for businesses and is not meant for anyone under 18. We don't knowingly collect data from children for our own purposes.
14. Complaints
If you're unhappy with how we've handled your data, please tell us first at connect@mudu.live. We'll acknowledge your complaint within 30 days and tell you what we're doing about it.
You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113. If you're in the EEA, you can complain to the data protection authority in your country.
15. Changes to this notice
We'll update this notice when how we use data changes. The date at the top shows the latest version. If a change matters to you, for example a new kind of data or a new way of using it, we'll email account holders before it takes effect.